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Abstract 

We apply the notion of quantum predicate proposed by D'Hondt and Panangaden to analyze 
a purely quantum language fragment which describes the quantum part of a future quantum 
computer in Knill's architecture. The denotational semantics, weakest precondition semantics, 
and weakest liberal precondition semantics of this language fragment are introduced. To help 
reasoning about quantum programs involving quantum loops, we extend proof rules for classical 
probabilistic programs to our purely quantum programs. 

1 Introduction 

The theory of quantum computing has attracted considerable research efforts in the past twenty 
years. Benefiting from the possibility of superposition of different states and the linearity of quantum 
operations, quantum computing may provide considerable speedup over its classical analogue [15, 6, 
7]. The existing quantum algorithms, however, are described at a very low level: they are usually 
represented as quantum circuits. A few works have been done in developing quantum programming 
languages which identify and promote high-level abstractions. Knill [8] moved the first step by 
outlining a set of basic principles for writing quantum pseudo-code; while the first actual quantum 
programming language is due to Omer [12]. After that, Sanders and Zuliani [13], Bettelli et al. [1], 
and Selinger [14] also proposed various quantum languages each having different features. 

The standard weakest precondition calculus [4] and its probabilistic extension [11] have been 
successful in reasoning about the correctness and even the rigorous derivation of classical programs. 
This success motivates us to develop analogous tools for quantum programs. Sanders and Zuliani 
[13] have provided for their qGCL a stepwise refinement mechanics. The approach, however, is 
classical in the sense that they treated quantum programs as special cases of probabilistic programs. 
As a consequence, known results about probabilistic weakest precondition calculus can be applied 
directly to quantum programs. Indeed, Butler and Hartel [2] have used it to reason about Grover's 
algorithm. 

The first step towards really quantum weakest precondition calculus was made by D'Hondt and 
Panangaden [3]. They proposed the brilliant idea that we can treat an observable, mathematically 
described by a Hermitian matrix, as the quantum analogue of 'predicate'. The elegant duality 
between state-transformer semantics and the weakest precondition semantics of quantum programs 
was then proven to hold in a more direct way. 

In this paper, we apply the ideas in [3] to analyze a purely quantum language fragment describing 
the quantum part of a potential quantum computer in Knill's architecture [8] . The syntax follows 
Selinger's style but we consider only purely quantum data. We introduce the denotational semantics 



for this purely quantum language fragment, which are represented by super-operators. The weakest 
precondition semantics corresponding to total correctness and weakest liberal precondition semantics 
corresponding to partial correctness are also introduced. To help reasoning about quantum loops, 
we also extend proof rules for classical probabilistic programs to our purely quantum programs. 

2 Preliminaries 

In this section, we review some notions and results from [3] which are the basis of our work. 

Let v. be the associated Hilbert space of the quantum system we are concerned with, and 
the set of linear operators (or complex matrices, we do not distinguish between these two notions) 
on v.. Let VH be the set of all density operators on Ti,, that is, 

Tm:={p& C{H) I C p, Tr(p) < 1}, 

where denotes the zero operator. The convention of allowing the trace of a density matrix to be 
less than 1 makes it possible to represent both the actual state (by the normalized density matrix) 
and the probability with which the state is reached (by the trace of the density matrix) [14]. The 
partial order □ is defined on the set of all matrices with the same dimension by letting M □ if 
N — M \s positive. Then the set of quantum programs over W is defined as 

QH := {£ e VH — > VH | £ is a super-operator}. 

We lift the partial order in VH to the one in QH by letting £ Q \i £{p) < J^{p) for any p € VH. 
It is proved in [3] that the two sets VH and QH are both CPOs. 

In D'Hondt and Panangadcn's approach, a quantum predicate is described by a Hcrmitian posi- 
tive matrix with the maximum eigenvalue bounded by 1. To be specific, the set of quantum predicates 
on Hilbert space W is defined by 

VH := {M e C{H) I Mt = M, CM C I}. 

For any p e VH and M G VH, the degree of p satisfying M is denoted by the expression TrMp. It 
is exactly the expectation of the outcomes when performing a measurement represented by M on 
the state p. 

The 'healthy' predicate transformers which exactly characterize all valid quantum programs are 
proved to be those who are linear and completely positive [3]. That is, there exists an isomorphic 
map between the set of healthy quantum predicate transformers 

TH := {T e VH — > VH \ T is linear and completely positve} 

and the set of quantum programs QH defined above, just as the cases for classical standard [4] and 
probabilistic programs [11]. 

3 The purely quantum language fragment and its semantics 

In this section, we concentrate our attention on the purely quantum fragment of a general program- 
ming language. That is, only quantum data but no classical data arc considered. Following Knill's 
QRAM model [8] , a quantum computer in the future possibly consists of a general-purpose classical 
computer which controls a special quantum hardware device. The quantum device contains a large, 
but finite number of individually addressable quantum bits. The classical controller communicates 
with the quantum device by sending a sequence of control instructions and receiving the results of 
the measurements on quantum bits. Our purely quantum language considered here then aims at 
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Figure 1: Denotational semantics 



labortlp := 

Iskiplp := p 

[[g:=0]]p := |0)g(0|p|0>g(0| + |0>,(l|p|l),(0| 

lq* = mp := U^pUl 

[[Si;S2h ■= [[S2MSih) 

[[measure q then So else S^^p [[5o]](|0)g(0|p|0),(0|) + [[5iK|l),(l|p|l),(l|) 

[[while q do S\p := U,^o [[(while q do 3)% 



describing the action of the special quantum device, rather than the behavior of the whole computer 
including the classical controller. 

Suppose S,So and Si denote purely quantum programs, qi,...,qn and q denote qubit-typed 
variables, and U denotes a unitary transformation which applies on a 2"-dimensional Hilbert space. 
The syntax of our purely quantum language is defined as follows: 

S ::= abort | skip \ q -.^ \ qi,q2, . . . ,qn* = U \ Sq; Si \ 
measure q then So else Si \ while q do S. 

Here wc borrow the notations from [14] except for the loop statements in which loop conditions 
are also purely quantum. Intuitively, the statement q := initializes qubit q by setting it to the 
standard state |0). Note that it is the only assignment in the language. This is also why our 
language is functional rather than imperative. The statement qi,q2, ■ ■ ■ ,qn* = U applies the unitary 
transformation J7 on n distinct qubits 9i, 92, • • • , We put the constraint that gi, 52, ■ • • , must 
be distinct to avoid syntactically some no-go operations such as quantum cloning. The statement 
measure q then 5*0 else 5*1 first applies a measurement on qubit q, then executes or Si depending 
on whether the measurement result is or 1. The loop statement while q do S measures qubit q 
first. If the result is 1, then it terminates; otherwise it executes S and the loop repeats. 

Formally, we have the following denotational semantics: 

Definition 3.1 For any purely quantum program S, the denotational semantics of S is a map [[S"! 
from VTi to T>H defined inductively in Figure 1, where (while q do S)^ := abort and 

(while q do S")*"*"^ := measure q then 5; (while q do 5)' else skip. 

In Definition 3.1, g denotes the abbreviation of gi, . . . , g„, Uq means applying U on the Hilbert 
space spanned by qubits q, and |0)q(0|p|0)g(0| denotes the application |0)(0| • |0)(0| on qubit q when 
the initial state is p, leaving other qubits unchanged. That is, 

|0),(0|p|0),(0| = [In, ® |0)(0| ® 7„Jp(7„, ® |0)(0| ® 7„J 

for some appropriate Hilbert spaces Tii and 'H2- In Section 4, we often omit the subscript q for 
simplicity when no confusion arises. 

The following lemma shows that the denotational semantics of our purely quantum programs are 
all super-operators. So they can be physically implemented in a future quantum computer. 
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Lemma 3.2 For any purely quantum program S, the denotational semantics of S is a super- operator 
onVn, i.e., M € QH. 

Proof. Wc prove the theorem by induction on the structure of S. When S has the form other than 
quantum loop, the proof is straightforward. So in what follows, we assume S = while q do S' and 
[[5"]] G QH for induction hypothesis. 

To prove US']] G QH, we need only to show that for any i>0, 

[[(while q do S)'} G QH (1) 

and 

[[(while q do S)'} C [[(while q do 3)'+^. (2) 

Eq.(l) is easy to prove by induction on i. To prove Eq.(2), notice first that for any p £ T^H, 
[[abortip = is the bottom element of VH. So [[abortj is the bottom element of QH and then 
Eq.(2) holds trivially for the case i = 0. Suppose further Eq.(2) holds for i = k. Then we calculate 
that for any p G VH, 

[[(while q do S)''+^p 
= E(while q do S)'^MS}{\0)g{0\p\0)g{0\)) + by definition 

□ [(while q do s)''-mmm,{o\p\o),m + 

induction hypothesis 

= [[(while q do S)'']\p. by definition 

Finally, from the fact that QH is a CPO we have [[S]] G QH. □ 

Note that the syntax of the language wc consider does not provide the power to create new 
qubits. So by our purely quantum programs we cannot implement all super-operators on VH since 
in general to realize a super-operator we need to introduce some auxiliary qubits. It seems to be a 
bad news. In practice, however, the number of qubits a quantum program can use is restricted by 
the maximum a real quantum computer can provide. The domain of the semantics of our purely 
quantum programs is the Hilbert space associated with the quantum device as a whole, so they 
indeed include all real operations wc can perform on a quantum computer. 

Following the idea of quantum predicate presented in [3], we define the weakest precondition 
semantics of our purely quantum programs as follows: 

Definition 3.3 For any purely quantum program S, the weakest precondition semantics of S is 
defined by a map wp.S from VH to VH defined inductively in Figure 2, where (while q do Sy is 

defined in Definition 3.1. 

An alternative definition of wp. (while q do S).M is the least fixed point pbX-{\Q)q{Q\wp.S.X\Q)q{(]\-\- 
|l)q(l|M|l)g(l|). It is easy to check that these two definitions are equivalent. 

The following theorem shows a quantitative relation between denotational semantics and weakest 
precondition semantics. Intuitively, the expectation of observing any quantum predicate on the 
output of a quantum program is equal to the expectation of observing the weakest precondition of 
this predicate on the input state. 

Theorem 3.4 For any purely quantum program S, quantum predicate M G VH, and p G VH, we 
have 

Tiiwp.S.M)p = TrM[[S']]p (3) 

Proof. We need only to consider the case that S = while q do S' is a quantum loop. Other cases 
are easy to check. 
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Figure 2: weakest precondition semantics 



wp. abort. M 
wp.skip.M 

wp.{q := 0).M 
wp.{q* = U).M 
wp.{Si;S2).M 



= 

= M 

= |0),(0|M|0)g(0| + |l),(0|M|0),(l| 

= wp.Si.{wp.S2.M) 



wp.(measure q then So else Si).M := \i)q{i\'wp.Si.M\i)q 



wp. (while q do S).M 



U~oM;p.(while q do S)\M 



Suppose Eq.(3) holds for the program S' , i.e., 

VM € -PH; peVn- Tt{wp.S'.M)p = TrM[[S"]]p. (4) 

We first prove by induction that for any i > 

VM ern;peVH- Ti{wp.S\M)p = TrM[[S"]]p. (5) 

When i = 0, Eq.(5) holds because both sides equal to 0. Suppose now that Eq.(5) holds for 
i = k. Then when i = k + 1, we calculate that for any M e VH and p £ VH, 

Ti{wp.S''+^.Mp) 
= Ti{\0)g{0\wp.S'.{wp.S\M)\0)g{0\ + |l}g(l|M|l},(l|)p 
= Tr{wp.S'.{wp.SKM)\0),{0\p\0),{0\) + TrM|l)g(l|p|l),(l| 
= TV((«;p.5^M)[[5']]|0)g(0|p|0)g(0|) + TrM|l),(l|p|l),(l| by Eq.(4) 
= TTM[[S''MS%0)g{0\p\0)g{0\) + TrM|l),(l|p|l>g(l| by induction hypothesis 

= TiMlS'^+^p. 

So we deduce that Eq.(5) holds for any i>0. And then 

Tr{wp.S.M)p = Tv{U,wp.S\M)p 
= UiTr{wp.S\M)p 
= U,TrM[[S']]p by Eq.(5) 

= TvMUiMb 
= TrMlSh- 

That completes our proof. □ 
Taking M = / in Eq.(3), we have 

Ti{wp.S.I)p = TrlSlp. 

Notice that the righthand side of the above equation denotes the probability the (un-normalized) 
output state [[S'lp is reached. So intuitively, for any purely quantum program S, the quantum 
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Figure 3: weakest liberal precondition semantics 



wlp.ahort.M 
wlp.skip.M 
wlp.{q := 0).M 
wlp.{q* = U).M 
wlp.{Si;S2).M 

w/p. (measure q then So else Si).M := 

wlp. {while q do S).M := 



/ 

M 

|0>,(0|M|0),(0| + |l)g(0|M|0),(l| 

wlp.Si{wlp.S2.M) 
1 

Y,\i)g{i\wlp.Si.M\i)g{i\ 

i=0 

nZowlp.{whi\e q do Sf.M 



predicate wp.S.I denotes the condition the program S terminates, in analogy with the predicate 
wp.S.tvvLe in classical standard setting and wp.S.I in classical probabilistic setting. 

We have so far defined the weakest precondition semantics, which is useful when we consider the 
total correctness of quantum programs. That is, what we care is not only the correctness of the final 
state when the program terminates, but also the condition and the probability a quantum program 
can terminate. To deal with partial correctness of quantum programs, we introduce the notion of 
weakest liberal precondition semantics as follows: 

Definition 3.5 For any purely quantum program S, the weakest liberal precondition semantics of S 
is defined by a map wlp.S from VTL to VTi. defined inductively in Figure 3, where (while q do Sy 
is defined in Definition 3.1. 

Analogous with weakest precondition semantics, an alternative definition of wlp. (while q do 5).M 

is the greatest fixed point i^X ■ {\0)g{0\wlp.S.X\0)g{0\ + \l)g{l\ M|l)g(l|). 

The following theorem shows a quantitative connection between denotational semantics and 
weakest liberal precondition semantics. 

Theorem 3.6 For any purely quantum program S, quantum predicate M G VH, and p G VH, we 
have 

Tt{wIp.S.M)p = TrMlSh + Trp - Tr[[5]]/9. (6) 
Proof. Similar to Theorem 3.4. □ 

Taking M = in Eq.(6), we have 

Tr{wlp.S.O)p = Trp - Tr^Sh- 

Notice that the righthand side of the above equation denotes the probability the program S does 
not terminate when the input state is p. So intuitively the quantum predicate wlp.S.O denotes the 
condition the program S diverges. 

Corollary 3.7 For any purely quantum program S and quantum predicate M S VTi., 

wp.S.M C wlp.S.M 

and 

wlp.S.M + wp.S.{I -M)=I 
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To get a clearer picture of the connection between these two precondition semantics, let us 
introduce a notion which is the analogue of conjunction A of classical standard predicates and 
probabilistic conjunction & of classical probabilistic predicates (see, for example, [10]). 

Definition 3.8 Suppose M and N are two quantum predicate. We define M!k,N as a new predicate 

MkN := {M + N-I)+, 

where for any Hermitian matrix X , if X = AjP^ is the spectrum decomposition of X, then 
X+ = J2^ max{Ai, 0}Pi. It is obvious that ifM + N^I, then MkN = M + N -I. 

Theorem 3.9 For any quantum predicates M,N G VH and any purely quantum program S, if 

M + N^I then 

wp.S.{MkN) = wp.S.M & wlp.S.N (7) 

and 

wlp.S.{MkN) = wlp.S.M k wlp.S.N (8) 

Proof. We only prove Eq.(7); the proof of Eq.(8) is similar. Prom the assumption that M + N ^ I, 
we have MkN = M + N -I. Then for any p : Vfi, 

Tvwp.S.{MkN)p 
= Trwp.S.{M + N - I)p 
= Tr{M + N - I)[[S}p 
= TtMIS]]p + TtNIS]]p-TtIS]]p 
= Trwp.S.Mp + Trwlp.S.Np - Trp 
= Tr{wp.S.M + wlp.S.N - I)p 

So we have wp.S.{MkN) = wp.S.M + wlp.S.N - I and then wp.S.{MkN) = wp.S.M k wlp.S.N 
from the fact that wp.S.{MkN) 3 0. □ 

When taking N = I in Eq.(7), we have the following direct but useful corollary: 

Corollary 3.10 For any purely quantum program S and quantum predicate M , 

wp.S.M = wp.S.I k wlp.S.M (9) 

Recall that wp.S.I denotes the condition the program S terminates. So the intuitive meaning 
of Eq.(9) is that a program is total correct (represented by weakest precondition semantics) if and 
only if it is partial correct (represented by weakest liberal precondition semantics) and it terminates. 
This capture exactly the intuition of total correctness and partial correctness. 

To conclude this section, we present some properties of weakest liberal precondition semantics 
which are useful in the next section. The proofs are direct so we omit the details here. 

Lemma 3.11 For any purely quantum program S and quantum predicate M,N £ VH, we have 

1) wlp.S.I = I; 

2) (monotonicity) if M ^ N then wlp.S.M C wlp.S.N; 
SjifM + NQI then wlp.S.{M + N) = wp.S.M + wlp.S.N; 
ijifM^N then wlp.S.{M - N) = wlp.S.M - wp.S.N . 



Theorem 3.4 
Theorems 3.4 and 3.6 
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4 Proof rules for quantum loops 

Proof rules for programs are important on the way to designing more general refinement techniques 
for programming. In this section, wc derive some rules for reasoning about loops in our purely 
quantum language fragment. We find that almost all loop rules derived in classical probabilistic 
programming (see, for example, [10] or [9]) can be extended to quantum case. 

In classical standard or probabilistic programming languages, an appropriate invariant is the key 
to reasoning about loops. It is also true in quantum case. So our first theorem is devote to reasoning 
about quantum loops within partial correctness setting using wZp-invariants. Recall that in classical 
probabilistic programming, if Inv is a wZp-invariant of a loop statement loop = "while b do S"' 
satisfying 

[b] * Inv ^ wlp.S.Inv, 

then 

Inv ^ wlp.loop.{^] * Inv). 

Here ^ means "everywhere no more than", which is the probabilistic analogue of the implication 

relation "=>" in standard logic. 

Theorem 4.1 For any quantum predicate M G VH, if 

1 

|0)(0|M|0)(0| □ wlp.S.{J2 \t)m\i){i\) (10) 

then 

1 

J2 \i)m\i){i\ E wlp.qloop.{\l){l\M\l){l\). 

Here and in what follows, by qloop we denote the quantum program "while q do S". 
Proof. By definition, we have 

wlp.qloop.{\l){l\M\l){l\) = n-oMj, 

where Mq = I and for j >1, 

M,+i = \0){0\wlp.S.Mj\0){0\ + |1)(1|M|1)(1|. 

In what follows, we prove by induction that for any j > 0, 

1 

J2\^){i\M\i){i\rMj. (11) 

When j = 0, Eq.(ll) holds trivially. Suppose Eq.(ll) holds for j = k. Then when j = k + 1, we 
have 

Mk+i = |0)(0Hp.5.Mfc|0)(0| + |l)(l|M|l)(l| 

1 

□ |0)(0|«;/p.5.(^ \i){i\M\i){im{0\ + |1)(1|M|1)(1| 

i=0 

induction hypothesis and Lemma 3.11 (2) 

□ |0>(0|M|0)(0| + |1>(1|M|1)(1|. Eq.(lO) 

With that we complete the proof of this theorem. □ 
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We say "^I^q \i){i\M\i){i\ is a wZp-invariant of qloop if Eq.(lO) holds; similarly, J2l=o 
is a wp-invariant of qloop if 

1 

|0)(0|M|0)(0| E wp.S.iYl (12) 

i=0 

We now turn to reasoning about quantum loops in total correctness setting. Following the 
remark behind Corollary 3.10, we give the total correctness of quantum loops by combining partial 
correctness with the termination condition. To simplify notations, we define 

T := wp.qloop.I. 

Intuitively, T denotes the termination condition of qloop. 

For any quantum loop, if a wp-invariant implies the termination condition, then its partial 
correctness is sufficient to guarantee its total correctness, as the following lemma states. 

Lemma 4.2 For any quantum predicate M e VH, if^l^o \i){i\M\i){i\ is a wp-invariant of qloop, 
wp.S.T C T, and 

^\i)m\z){t\rT, (13) 

i=0 

1 

J2 \i){i\M\i){i\ E wp.qloop.{\l){l\M\l){l\). 



then 



i=0 



Proof. Let 



M' ■.= J2\i){i\M\i){i\+ 1 - T. 

i=0 

Noticing that from definition we have T = |0)(0|wp.S'.T|0)(0| + |1)(1|, then 

|0)(0|r|0)(0| = \0){0\wp.S.T\0){0\, (14) 

|1)(1|T|1)(1| = |1)(1| (15) 
and ^ 

J2mT\i){i\=T. (16) 



i=0 



Furthermore, we can check that M' = X]i=o From the assumption Eq.(13), we can 
easily derive C M' C I, and M' is also a quantum predicate on H. We calculate 

wlp.S.Y,\i){^\M'\i){i\ 
= wlp.S.{J2\^){i\M\i){i\+ I -T) 

= wp.S.J2\i)ii\M\i){i\ + wlp.S.{I -T) Lemma 3.11 (3) 

= wp.S. \i){i\M\i){i\ + wlp.S.I - wp.S.T Lemma 3.11 (4) 

□ |0)(0|M|0)(0| +1 -T Lemma 3.11 (1) and Eq.(12) 

= |0)(0|M|0)(Ol + |0)(0|-|0)(0|r|0)(0| Eqs.(14) - (16) 

= |0)(0|M'|0)(0|. 
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So J2i=o ^ wlp-'mva,nant of qloop. We further calculate 

1 

5^|z)(i|M|i)(i| 

= M' + T- I definition of M' 

C wlp.qloop.{\l){l\M'\l){l\)+T-I Theorem 4.1 

= wlp.qloop.{\l){l\M'\l){l\) &cT Corollary 3.7 

= wp.qloop.{\l){l\M' Eq. (9) 
= wp.qloop.{\l){l\M Eq. (15) 

That completes our proof. □ 

To conclude this section, we generalize the powerful 0-1 law in classical programming to quantum 

case. Informally, 0-1 law states that if the probability of a loop terminating from a state is at least 
p for some fixed p > (no matter how small p is), then the loop terminates with certainty when 
started from that state. In other words, the terminating probability is either or 1 and cannot lie 
properly between and 1. 

Lemma 4.3 For any quanf,um predicate M € VTC, «/X]i=o I*) (*l ^ wp-invariant of qloop, 

wp.S.T QT, and3 0<p<l such that p * J2]^f^ \i){i\M\i){i\ C T then 

j2\i)m\i){i\QT. 

i=0 

Proof. Let M' :=p* M. Then X^Lo K>(^I-^'N)(^I E T and furthermore, 

|0)(0|M'|0)(0| = p* |0)(0|M|0)(0| 

1 

C p*wp.S.{Y^\i){i\M\i){i\) 

1 

= wp.S.(^\i){i\M'\i){i\). linearity of wp.S 

So we can derive that 

1=0 j=0 

C wp.qloop.{\l){l\M' Lemma 4.2 

= p* wp.qloop.{\l){l\M\l){l\) linearity of uip.gloop 

C p* wp.qloop.I monotonicity of wp.qloop 

= p*T. 

Dividing both sides by the positive number p, we arrive at the desired result. □ 

Theorem 4.4 (0-1 law for quantum loops) If T is positive-definite and wp.S.T C T, then for any 
quantum predicate M G VH such that 



\0){0\M\0){0\Qwp.S.iJ2\i){imi){i\), 



i=0 



10 



we have 

1 

\i)m\i)'^\ E wp.qloop.{\l){l\M\l){l\). 

Proof. From the assumption that T is positive-definite, for any wp-invariant X]i=o 
of qloop there exists a sufficiently small but positive p such that p * \i) {i\M\i) {i\ C T. So 

Si=o E ^ from Lemma 4.3. Then the result of this theorem holds by applying Lemma 

4.2. □ 

5 Conclusion 

In this paper, we applied the notion of quantum predicate proposed by D'Hondt and Panangaden 
in [3] to analyze a purely quantum language fragment which involves only quantum-typed vari- 
ables. This language can be treated as the quantum fragment of a general programming language, 
describing the quantum device of a future quantum computer in Knill's architecture. The deno- 
tational semantics of this language was introduced. We further proposed the weakest precondition 
semantics and weakest liberal precondition semantics, corresponding respectively to total and partial 
correctness of quantum programs. The connections between these three semantics were discussed. 
To help reasoning about quantum loops, we extended all existing proof rules for loops in classical 
probabilistic programs to the case of our purely quantum programs. 
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